chore(ops): prune build cache in deploy.sh + document rescale & disk maintenance

deploy.sh already pruned old images but never build cache — the larger half
of disk creep from CI rebuilds (root fs hit 83% on prod). Add
`docker builder prune --filter until=168h` alongside the existing image prune
so cleanup happens every deploy, version-controlled, no host cron.

Docs (hetzner-server-setup.md, Maintenance section):
- New "Rescaling / Upgrading the Server" — when/why, same-arch (Arm/CAX) +
  CPU-RAM-only vs irreversible disk-expand constraints, poweroff→rescale→
  power-on→verify steps, and the Arm-capacity-unavailable-in-DC caveat.
- New "Disk Maintenance (Docker Pruning)" — emergency manual prune + the
  automated deploy.sh approach.
- Fixed stale Resource Budget: cadvisor 128→192 MB (matches compose),
  total 672→736 MB, and "live-upgrade" wording (rescale needs a power-off).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/deploy.sh

@@ -88,9 +88,12 @@ if ! curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
     exit 4
 fi
 
-# ── 6. Clean up old Docker images ───────────────────────────────────────────
-log "Pruning unused Docker images …"
+# ── 6. Clean up old Docker images + build cache ─────────────────────────────
+# Image prune alone leaves CI build cache to grow unbounded (the larger half of
+# disk creep). Prune both; keep the last week of cache so CI stays fast.
+log "Pruning unused Docker images and build cache …"
 docker image prune -f --filter "until=72h" > /dev/null 2>&1 || true
+docker builder prune -f --filter "until=168h" > /dev/null 2>&1 || true
 
 log "Deploy complete."
 exit 0